A ransomware group has made a bold claim, but investigators are still searching for evidence that could show what was exposed.
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has classified a cyberattack on one of its systems as a “major incident.” This designation is provided for under federal law and requires the agency to formally notify the U.S. Congress.
ATF said its specialists are responding to an attack on a standalone system that was not connected to the bureau’s main network. An agency spokesperson told reporters that the compromised computer stored information, including data related to ATF investigative targets.
Qilin group claims responsibility for ATF breach
The Qilin ransomware group claimed responsibility for the attack on its leak site. However, the hackers did not release evidence that they had accessed ATF data: they shared neither samples of allegedly stolen files nor any other information that could substantiate their claims.
Qilin operates under a “ransomware-as-a-service” model. Under this arrangement, the group provides attack tools to other criminal operators and, in return, receives a share of any ransom victims may pay to regain access to their data.
Qilin has previously claimed attacks against several other organizations, including media company Lee Enterprises and the British pathology laboratory network Synnovis.
Why ATF declared a “major incident”
U.S. federal rules define major cyber incidents as those that could potentially cause significant harm to the country’s national security or broader U.S. interests. When an incident receives this status, a government agency must notify Congress no later than seven days after detecting the attack.
ATF is one of several U.S. federal agencies that have reported major cyber incidents in recent years. In 2023, a ransomware attack on the U.S. Marshals Service system received a similar designation. Earlier in 2026, a breach of an FBI system exposed the phone numbers of people under surveillance by federal agents.
ATF is continuing its response to the incident, while Qilin’s claims that it stole bureau data remain unconfirmed.
Click Here For The Original Source.
